Loading vulnerability…
CVE-2017-16995 is a flaw in the Linux kernel eBPF verifier, specifically in the check_alu_op function in kernel/bpf/verifier.c, affecting Linux kernel versions through 4.4. The vulnerability is caused by incorrect sign extension during verifier handling of ALU operations. A local attacker can supply a crafted eBPF program via the eBPF syscall that passes verifier checks despite unsafe semantics, leading to kernel memory corruption. Public reporting also associates the flaw with local privilege-escalation exploitation on vulnerable Linux systems, including Ubuntu kernels in affected version ranges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository contains two C-language local privilege escalation exploits (44298.c and 45010.c) targeting CVE-2017-16995, a vulnerability in the Linux kernel's eBPF implementation. Both exploits are designed to be compiled and run by an unprivileged user on a vulnerable system (notably Ubuntu 16.04 and Fedora 27 with specific kernel versions). The exploits work by abusing eBPF system calls to manipulate kernel memory, locate the current process's credentials structure, and overwrite the UID and GID fields to 0 (root). Upon success, they spawn a root shell (/bin/bash or /bin/sh), granting full administrative access. The README.md provides compilation and usage instructions, emphasizing that the code is for educational and testing purposes only. No network endpoints or remote attack vectors are present; exploitation requires local code execution on the target system.
This repository contains a local privilege escalation exploit for CVE-2017-16995, targeting Ubuntu 16.04.4 and other Linux distributions (Debian/Ubuntu) running vulnerable kernels (4.4-4.14). The exploit leverages a flaw in the eBPF verifier, allowing a low-privileged user to gain arbitrary kernel memory read/write, ultimately overwriting their own credentials to escalate privileges to root. The repository consists of two files: a README.md (providing background, affected versions, demonstration, and mitigation steps) and exploit.c (the actual exploit code). The exploit must be compiled and executed locally on a vulnerable system. Upon success, it spawns a root shell. The README also provides mitigation advice, such as disabling unprivileged bpf(2) or upgrading the kernel.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Linux kernel use-after-free / privilege escalation vulnerability affecting Ubuntu kernel versions 4.10.5 through before 4.14.3, referenced via a public exploit.
A Linux kernel eBPF verifier privilege escalation vulnerability in 4.4.x kernels that allows an unprivileged user to gain root privileges.
A Linux/Ubuntu local privilege escalation vulnerability used by the attackers as part of their post-compromise tooling to gain elevated privileges.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.